From patchwork Mon Jun 29 17:18:58 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Konstantin Khlebnikov X-Patchwork-Id: 6690441 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 0D5669F39B for ; Mon, 29 Jun 2015 17:19:58 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 0C5C920430 for ; Mon, 29 Jun 2015 17:19:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E022320421 for ; Mon, 29 Jun 2015 17:19:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752658AbbF2RTJ (ORCPT ); Mon, 29 Jun 2015 13:19:09 -0400 Received: from forward-corp1g.mail.yandex.net ([95.108.253.251]:44463 "EHLO forward-corp1g.mail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752582AbbF2RTD (ORCPT ); Mon, 29 Jun 2015 13:19:03 -0400 Received: from smtpcorp1m.mail.yandex.net (smtpcorp1m.mail.yandex.net [77.88.61.150]) by forward-corp1g.mail.yandex.net (Yandex) with ESMTP id 8605E3660B7A; Mon, 29 Jun 2015 20:18:58 +0300 (MSK) Received: from smtpcorp1m.mail.yandex.net (localhost [127.0.0.1]) by smtpcorp1m.mail.yandex.net (Yandex) with ESMTP id 4B8EA2CA0341; Mon, 29 Jun 2015 20:18:58 +0300 (MSK) Received: from unknown (unknown [2a02:6b8:0:408:5c4e:c25f:503e:96d8]) by smtpcorp1m.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id NJqRKefwsh-IwXqYsSp; Mon, 29 Jun 2015 20:18:58 +0300 (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (Client certificate not present) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1435598338; bh=QC8ESLQqHaCmF+MS5YfeXGKR915/8+ocd/jqv389l5c=; h=Subject:From:To:Cc:Date:Message-ID:In-Reply-To:References: User-Agent:MIME-Version:Content-Type:Content-Transfer-Encoding; b=eF1/rw2FDUA9/dFcxle4ypBey8CKOe2egu0yk2roO8uW7wQGDr4t9MWh5c2EQwi0z yubbcfyTfIqyCScxd6oprlMU/IcPBWsHoLYPlzoSqXLliCv+Whx+p5fE9yZooeCCuj OR/bFt1jfBKyhW0g40UYVf0VkgpO+WW8fHAlyHl8= Authentication-Results: smtpcorp1m.mail.yandex.net; dkim=pass header.i=@yandex-team.ru Subject: [PATCH 2/4] ovl: honor MS_NOEXEC flag at overlayfs mount From: Konstantin Khlebnikov To: linux-fsdevel@vger.kernel.org, Miklos Szeredi , linux-kernel@vger.kernel.org, Alexander Viro , linux-unionfs@vger.kernel.org Cc: linux-security-module@vger.kernel.org Date: Mon, 29 Jun 2015 20:18:58 +0300 Message-ID: <20150629171858.15730.90697.stgit@buzz> In-Reply-To: <20150629171856.15730.58271.stgit@buzz> References: <20150629171856.15730.58271.stgit@buzz> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Overlayfs opens files directly at underlying filesystem. File->f_path.mnt points to private clone of lower/upper mount. Thus MS_NOEXEC at overlayfs mount has no effect because all checks are done against underlying mount. This patch clears "noexec" at private lower/upper mounts (if noexec isn't locked) and checks MNT_NOEXEC in overlayfs mount flags in ->dentry_open(). MS_NODEV already works correctly because kernel checks it before opening. Signed-off-by: Konstantin Khlebnikov --- Documentation/filesystems/Locking | 2 +- Documentation/filesystems/vfs.txt | 2 +- fs/open.c | 2 +- fs/overlayfs/inode.c | 14 ++++++++++++-- fs/overlayfs/super.c | 14 ++++++++++++++ include/linux/fs.h | 3 ++- 6 files changed, 31 insertions(+), 6 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking index 6a34a0f4d37c..f949910a9ff8 100644 --- a/Documentation/filesystems/Locking +++ b/Documentation/filesystems/Locking @@ -67,7 +67,7 @@ prototypes: struct file *, unsigned open_flag, umode_t create_mode, int *opened); int (*tmpfile) (struct inode *, struct dentry *, umode_t); - int (*dentry_open)(struct dentry *, struct file *, const struct cred *); + int (*dentry_open)(struct path *, struct file *, const struct cred *); locking rules: all may block diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt index 5eb8456fc41e..f5557f06ce12 100644 --- a/Documentation/filesystems/vfs.txt +++ b/Documentation/filesystems/vfs.txt @@ -364,7 +364,7 @@ struct inode_operations { int (*atomic_open)(struct inode *, struct dentry *, struct file *, unsigned open_flag, umode_t create_mode, int *opened); int (*tmpfile) (struct inode *, struct dentry *, umode_t); - int (*dentry_open)(struct dentry *, struct file *, const struct cred *); + int (*dentry_open)(struct path *, struct file *, const struct cred *); }; Again, all methods are called without any locks being held, unless diff --git a/fs/open.c b/fs/open.c index e0250bdcc440..b619e28b2740 100644 --- a/fs/open.c +++ b/fs/open.c @@ -865,7 +865,7 @@ int vfs_open(const struct path *path, struct file *filp, struct inode *inode = path->dentry->d_inode; if (inode->i_op->dentry_open) - return inode->i_op->dentry_open(path->dentry, filp, cred); + return inode->i_op->dentry_open(path, filp, cred); else { filp->f_path = *path; return do_dentry_open(filp, NULL, cred); diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index 308379b2d0b2..b9a40c8dbd1e 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -10,6 +10,7 @@ #include #include #include +#include #include "overlayfs.h" static int ovl_copy_up_last(struct dentry *dentry, struct iattr *attr, @@ -337,14 +338,23 @@ static bool ovl_open_need_copy_up(int flags, enum ovl_path_type type, return true; } -static int ovl_dentry_open(struct dentry *dentry, struct file *file, - const struct cred *cred) +static int ovl_dentry_open(const struct path *path, struct file *file, + const struct cred *cred) { + struct dentry *dentry = path->dentry; int err; struct path realpath; enum ovl_path_type type; bool want_write = false; + /* + * After opening file->f_path.mnt points to private lower/upper mount. + * Here is the last chance to check flags at overlayfs mount. + */ + if ((file->f_flags & __FMODE_EXEC) && + (path->mnt->mnt_flags & MNT_NOEXEC)) + return -EACCES; + type = ovl_path_real(dentry, &realpath); if (ovl_open_need_copy_up(file->f_flags, type, realpath.dentry)) { want_write = true; diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 00e1d0b3abdd..64c3714acf38 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -923,6 +923,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) goto out_put_lowerpath; } + /* + * Drop noexec at upper mount if allowed. We'll check + * MNT_NOEXEC at overlayfs mount in ovl_dentry_open(). + */ + if (!(ufs->upper_mnt->mnt_flags & MNT_LOCK_NOEXEC)) + ufs->upper_mnt->mnt_flags &= ~MNT_NOEXEC; + ufs->workdir = ovl_workdir_create(ufs->upper_mnt, workpath.dentry); err = PTR_ERR(ufs->workdir); if (IS_ERR(ufs->workdir)) { @@ -951,6 +958,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) */ mnt->mnt_flags |= MNT_READONLY; + /* + * Drop noexec at lower mount if allowed. We'll check + * MNT_NOEXEC at overlayfs mount in ovl_dentry_open(). + */ + if (!(mnt->mnt_flags & MNT_LOCK_NOEXEC)) + mnt->mnt_flags &= ~MNT_NOEXEC; + ufs->lower_mnt[ufs->numlower] = mnt; ufs->numlower++; } diff --git a/include/linux/fs.h b/include/linux/fs.h index e351da4a934f..55c3edd9519e 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1653,7 +1653,8 @@ struct inode_operations { int (*set_acl)(struct inode *, struct posix_acl *, int); /* WARNING: probably going away soon, do not use! */ - int (*dentry_open)(struct dentry *, struct file *, const struct cred *); + int (*dentry_open)(const struct path *, struct file *, + const struct cred *); } ____cacheline_aligned; ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,